CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

CVE-2026-64574

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: tear down new links on vif update error path When ieee80211vifupdatelinks adds new links it allocates a link container for each and calls ieee80211linkinit which registers the per-link debugfs files with...

CVE-2026-64578

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate compound request size before reading StructureSize2 When ksmbd validates a compound chained SMB2 request, ksmbdsmb2checkmessage reads pdu-StructureSize2 without first checking that the compound element is large...

CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...

CVE-2026-64569

In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mplsvalidfibdumpreq on CONFIGINET=n On CONFIGINET=n builds, mplsvalidfibdumpreq walks the parsed attribute table itself instead of calling ipvalidfibdumpreq. The RTAOIF arm passes tbRTAOIF to nlagetu32...

CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

CVE-2026-64566

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: propagate SKBFLSHAREDFRAG in iptfsskbaddfrags When iptfsskbaddfrags copies frag references from the source frag walk into a new SKB, it increments the page reference count via skbfragref but does not propagate...

CVE-2026-64568

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsolbcastproberesp double free on alloc failure ieee80211setunsolbcastproberesp calls kfreercu on the old template before allocating the replacement. If the kzalloc then fails, it returns -ENOMEM while...

CVE-2026-64567

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, loadfreespacecache takes numentries and numbitmaps straight from the on-disk btrfsfreespaceheader. That header is stored in the...

CVE-2026-64570

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix filsdiscovery double free on alloc failure ieee80211setfilsdiscovery calls kfreercu on the old template before allocating the replacement. If the kzalloc then fails, it returns -ENOMEM while...

UBUNTU-CVE-2026-64579

In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrmhashrebuild reinsert xfrmhashrebuild's first loop preallocates the bins/chains the reinsert loop needs, so the reinsert after hlistdelrcu cannot allocate or fail. But its guard is...

UBUNTU-CVE-2026-64570

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix filsdiscovery double free on alloc failure ieee80211setfilsdiscovery calls kfreercu on the old template before allocating the replacement. If the kzalloc then fails, it returns -ENOMEM while...

UBUNTU-CVE-2026-64577

In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...

UBUNTU-CVE-2026-64573

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLVTYPENVM branch of qcatlvcheckdata the tag loop bound is "while idx length - sizeofstruct tlvtypenvm". "length" is a signed int from the firmware TLV header and...

UBUNTU-CVE-2026-64571

In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54rxeepromreadback p54rxeepromreadback copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit...

UBUNTU-CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fibalias with kfreercu on insert error path fibtableinsert publishes newfa into the leaf's falist with fibinsertalias before calling the fib entry notifiers. When a notifier fails, the error path removes newfa wit...

UBUNTU-CVE-2026-64568

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsolbcastproberesp double free on alloc failure ieee80211setunsolbcastproberesp calls kfreercu on the old template before allocating the replacement. If the kzalloc then fails, it returns -ENOMEM while...

UBUNTU-CVE-2026-64581

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix skdstcache double-free in xfrmuserpolicy xfrmuserpolicy clears the socket dst cache with skdstreset, i.e. the non-atomic skdstsetsk, NULL: it reads skdstcache with rcudereferenceprotected, stores NULL and dstreleases th...

UBUNTU-CVE-2026-64576

In the Linux kernel, the following vulnerability has been resolved: nexthop: initialize extack in nhresbucketmigrate nhresbucketmigrate passes an uninitialized netlinkextack to callnexthopresbucketnotifiers. When nhnotifierresbucketinfoinit fails e.g. the kzalloc returns -ENOMEM, the error is...

UBUNTU-CVE-2026-64575

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...